Abuse ACL access over groups
Use access rights over a group to add users
Tag: Active Direcotory
Abuse ACL Access over User
Use access rights over a user to take over that user account.
Categories:
ACL Abuse
Abuse of ACL access rights to achieve lateral movement
Categories:
Active Directory
Enumerate and compromise networks running Microsoft Active Directory
Categories:
AD CS
Abuse Active Directory Certificate Service to achieve lateral movement and total domain compromise.
Categories:
ASREProasting
Take advantage of users with no Kerberos pre-authentication requirements and recover their password
Categories:
Credentialed Enumeration
Get a full view of the domain after obtaining a set a credentials
Categories:
Domain User and Group Enumeration
Enumerate users and groups within an Active Directory domain
Categories:
ESC1 and ESC2
Request certificate as another user with enrollee-supplied subject
Categories:
ESC3
Request certificate on behalf of another user with a enrollment agent certificate
Categories:
ESC4
Leverage vulnerable certificate access control to escalate privileges.
Categories:
Group Managed Service Account
Read the NT password hash of Group Managed Service Accounts (gMSA)
Categories:
Initial Access
What do I have to do to get my first set of domain credentials?
Categories:
Initial Enumeration
Enumeration of AD domain without credentials
Categories:
Kerberoasting
The classic AD privilege escalation technique to crack the passwords of service accounts offline
Categories:
Kerberos
Abusing the ticket-based authentication and authorization protocol that governs the operation of Active Directory
Categories:
Lateral Movement and Privilege Escalation
Move from account to account, service to service, and machine to machine while escalating your privileges until you compromise the domain.
Categories:
LLMNR/NBT-NS/mDNS Poisoning
Poison multicast name resolution protocols for NetNTLM hashes
Categories:
Silver Ticket
Impersonate any user to a service by crafting service tickets
Categories:
SMB Relay Attack
SMB Relay Attack
Categories:
Domain Enumeration with Bloodhound CE
Collect and analyze domain data with Bloodhound CE